I would like to start off saying I am not the Orion admin. I am the network engineer. I hope I can provide enough information to help solve the problem we are having.
We are use Orion to monitor our branch offices connected by a MPLS network. Each site has a T1. Some have secondary connections. We monitor routers, switches, and servers at each office. From what I have been told, we poll the router more often than other device so we can detect the router down or in trouble, hopefully before the branch office knows there is an issue.
My basic understanding of Orion is Orion uses ICMP pings to determine if the router is up. Orion will mark the router in a warning state if we miss a couple of pings. I understand this may seem too quick, but this is what we have to work under.
The Orion admin has written a script that will do trace routes from the Windows server (to the router, switch, and branch server) if the router enters a warning state. The problem is we see way too many of these trace files. I can correlate the time on the trace routes to packet captures. Each time a trace is generated I see in the packet capture:
The Orion server sends an ICMP Echo.
The router will respond with an ICMP Echo Reply.
Almost immediately the Orion server will respond with an ICMP Destination Unreachable, Protocol Unreachable. This corresponds to an ICMP Type 3, Code 2.
Most of the ICMP traffic between Orion and the router is normal: Echo->Echo Reply.
There is no apparent problem on the network. We run voice and many other applications across the network. No issues. What do we need to look at? Why would the Orion server respond with the "protocol unreachable"? I would appreciate another take on this problem.
